Metraipolis › archive › dc_fb4ce99ec1e5

It is Not Yet Another Tool: Creating and Deploying an Agentic AI Companion in a Security Operations Center — arXiv:2609.06250

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.06250
License (as archived): CC0-1.0
Archived: 2026-10-16T13:40:07.756Z
SHA-256 of the archived text: 1e72c5cfafc75dedd79c4a1e7d18a383c1f485e155e82e9c04f44caf1ddacdd4
Stable URL of this page: https://metraipolis.com/documento/dc_fb4ce99ec1e5

How to cite

It is Not Yet Another Tool: Creating and Deploying an Agentic AI Companion in a Security Operations Center — arXiv:2609.06250 — arXiv (en), https://arxiv.org/abs/2609.06250 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_fb4ce99ec1e5 (Metraipolis archive dc_fb4ce99ec1e5, sha256 1e72c5cfafc75dedd79c4a1e7d18a383c1f485e155e82e9c04f44caf1ddacdd4)

BibTeX

@misc{dcfb4ce99ec1e5,
  title = {It is Not Yet Another Tool: Creating and Deploying an Agentic AI Companion in a Security Operations Center — arXiv:2609.06250},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.06250},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_fb4ce99ec1e5; sha256 1e72c5cfafc75dedd79c4a1e7d18a383c1f485e155e82e9c04f44caf1ddacdd4},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.06250. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Security Operations Centers (SOCs) process large amounts of tickets, most of which are low-interest events not worthy of further investigation. The repetitive nature of this task and similarity of the vast amounts of tickets make it a prime candidate for generative AI-based automation. We created and deployed an agentic AI companion utilizing large language models through fieldwork within a SOC for over one year. The design of the SOC AI companion was driven by researchers' participation and interactions within the SOC's daily work. SOC analysts were invited to use it during the last four months of the fieldwork. We analyzed the analysts' usage of the companion and found that in more than 90% of the cases the companion's outputs were reused by analysts in the ticket's closing report. Our results showed that when designed "in the trenches" with the intended users, a SOC AI companion can go beyond being yet another tool, but rather a system that co-evolves with its human users as it traverses through the various types of workloads. Analysts naturally started to shape the AI companion's behaviors to fit their particular needs. Our data show that the more human analysts shape the AI companion's behaviors, the more they become comfortable trusting the output from the AI system, resulting in improved productivity.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-09-09 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI).
Pagina del lavoro: https://arxiv.org/abs/2609.06250 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-16T13:09:48.411Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-09-09?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).